VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 301)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 301)
SeverityVulnerabilityCVEInstallsPublished
Medium6.4Authenticated (Contributor+) Cross-Site Scripting via 'tweet_title' Shortcode Attribute
Twitter Feeds≤1.0.0No patch available
CVE-2026-1911—
Medium6.5Authenticated (Subscriber+) Arbitrary File Read
Task Manager≤3.0.2No patch available
CVE-2026-2351—
Medium4.3Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via 'speedup01_enabled' AJAX Action
Speedup Optimization≤1.5.9No patch available
CVE-2026-4127—
Medium6.5Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task_id' Parameter
Task Manager≤3.0.2No patch available
CVE-2026-4004—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'outgrow' Shortcode 'id' Attribute
Outgrow≤2.1No patch available
CVE-2026-1889—
Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting via 'naam' Parameter
Alfie – Feed Plugin≤1.2.1No patch available
CVE-2026-4069—
Medium4.3Cross-Site Request Forgery to Settings Update
Neos Connector for Fakturama≤0.0.14No patch available
CVE-2026-4143—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' Shortcode Attribute
WordPress PayPal Donation≤1.01No patch available
CVE-2026-4072—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
WP Games Embed≤0.1betaNo patch available
CVE-2026-3996—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
Text Toggle≤1.1No patch available
CVE-2026-3997—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' and 'name' Shortcode Attributes
Paypal Shortcodes≤0.3No patch available
CVE-2026-3617—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'titles' Shortcode Attribute
Sheets2Table≤0.4.1No patch available
CVE-2026-3619—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute
fyyd podcast shortcodes≤0.3.1No patch available
CVE-2026-4084—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'client' Shortcode Attribute
Ad Short≤2.0.1No patch available
CVE-2026-4067—
Medium6.5Unauthenticated Privilege Escalation via 'role' Parameter
App Builder – Create Native Android & iOS Apps On The Flight≤5.5.10No patch available
CVE-2026-2375—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Ecover Builder For Dummies≤1.0No patch available
CVE-2026-4077—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Show Posts list – Easy designs, filters and more≤1.1.0No patch available
CVE-2026-4022—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attribute
WP Random Button≤1.0No patch available
CVE-2026-4086—
High7.5Unauthenticated SQL Injection via 'qntn_wp_access' Cookie
Quentn WP≤1.2.12Update to 1.2.13
CVE-2026-2468—
High7.2Unauthenticated Stored Cross-Site Scripting via 'vagaro_code'
Vagaro Booking Widget≤0.3No patch available
CVE-2026-3003—
Medium5.3Missing Authorization to Unauthenticated Chatbot Configuration Takeover
WP-Chatbot for Messenger≤4.9No patch available
CVE-2026-3506—
High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Update via linksy_search_and_replace_item_details
Linksy Search and Replace≤1.0.4No patch available
CVE-2026-2941—
Medium6.5Authenticated (Subscriber+) SQL Injection via 'hint_ids' Parameter
Pre* Party Resource Hints≤1.8.20No patch available
CVE-2026-4087—
High8.8Authenticated (Subscriber+) Privilege Escalation to Administrator via save_extra_user_profile_fields
Expire Users≤1.2.2No patch available
CVE-2026-4261—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Scoreboard for HTML5 Games Lite≤1.2Update to 1.3
CVE-2026-4083—
Medium4.9Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter
EmailKit – Email Customizer for WooCommerce & WP≤1.6.3Update to 1.6.4
CVE-2026-3474—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via '_cl_map_iframe' Parameter
Contact List – Online Staff Directory & Address Book≤3.0.18Update to 3.0.19
CVE-2026-3516—
High7.2Unauthenticated Stored Cross-Site Scripting via Query Parameter Name
Injection Guard≤1.2.9Update to 1.3.0
CVE-2026-3368—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Post Title
Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI≤1.8.2Update to 1.8.3
CVE-2026-3350—
Critical9.8Unauthenticated Remote Code Execution via form_process
Kali Forms — Contact Form & Drag-and-Drop Builder≤2.4.9Update to 2.4.10
CVE-2026-3584—

Search VulnCrest Radar

Jump to

Are you sure?